1. Field of Invention
The present invention pertains to the field of distributed applications. More particularly, this invention relates to correlating protocol events in distributed applications.
2. Art Background
Distributed applications including distributed applications which are used for business transactions may be viewed as multi-tier arrangements of hardware components and/or software components that support multiple users. Examples of distributed applications include web-based applications such as applications involved in e-commerce, as well as groupware applications, order processing and inventory management applications, etc. Examples of hardware components of a distributed application include CPU, memory, mass storage, and network bridges. Examples of software components of a distributed application include processes, file systems, data base servers, web servers, client applications, and server applications.
A variety of mechanisms exist for communication among the various software and/or hardware components of a distributed application. Examples include remote procedure calls (RPC), system query language (SQL), peripheral component interconnect (PCI), Ethernet, transfer control protocol/internet protocol (TCP/IP), sockets, hypertext transfer protocol (HTTP), etc. These protocols typically involve the exchange of messages between hardware and/or software components. An exchange of a message between hardware and/or software components whether on the same machine or not may be referred to as a protocol event.
Typically, the interactions of end-users with such a distributed application cause a variety of protocol events to occur at many different levels in the distributed application. Such an interaction may be an action or grouping of actions taken by an end-user of the distributed application. In addition, events generated by software tasks in a distributed application usually cause a variety of protocol events to occur at many different levels in the distributed application.
Moreover, protocol events that are directly caused by an end user action or software event typically cause more protocol events to occur at lower levels in a distributed application. In a web-based based e-commerce application, for example, an end-user action may take the form of clicking a buy button or clicking on item buttons while browsing items with a web browser. Each such click typically generates protocol events in the form of HTTP commands. Each HTTP command in turn usually generates other protocol events at lower levels in the distributed system to communicate the HTTP command to a web server. In response, the web server at still a lower level in the distributed system typically generates protocol events such as SQL statements for data base access or protocol events for file system access to carry out the HTTP command. An end user action or a software event that causes protocol events to occur at lower levels in a distributed application may be referred to as a high level transaction.
Such distributed applications typically provide support for large numbers of end user interactions and software tasks. As a consequence, large numbers of overlapping protocol events usually flow among the hardware and software components of the distributed application. It is usually desirable to correlate the protocol events in a distributed application to the high level transactions that caused them. Such a capability is useful for a variety of system management tasks such as performance monitoring, diagnosis, and capacity planning. It is also usually desirable that a mechanism that provides such correlation be non-invasive in the sense that it does not require the modification of hardware components or a rewrite and/or recompilation of the software components in the distributed application.
Mechanisms are disclosed for correlating protocol events in a distributed application to the high level transactions that caused the protocol events. The mechanisms for correlating include a set of protocol sensors which are associated with the components of the distributed application. Each protocol sensor detects the protocol events generated by its corresponding component of the distributed application. The detection of protocol events by the protocol sensors in non-invasive in that it does not require recoding or recompilation of software components or redesign or modification of hardware components. The mechanisms for correlating also include a set of event correlators associated with the protocol sensors. Each event correlator uses the results of a prior training phase for the distributed application to determine which of a set of high level transactions in the distributed application caused the corresponding protocol events.
Other features and advantages of the present invention will be apparent from the detailed description that follows.